Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

141–150 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#141

Post by pak9rabid »

andreareina wrote: post #12
RyJones wrote: post #7

Earlier quoted context omitted.

buy any dongle that sells for under $100 on amazon. they all have the same mac, and come with 'bespoke' apps to let you do things to your car. those apps are all thin wrappers on code widely shared; they use the MAC of the dongle as the keystone for ID. Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.…

Amazing! I have the same MAC address on my luggage!

00:11:22:33:44:55

Re: My security camera shipped a GitHub admin token in its login page

#142

Post by badatnames »

nozzlegear wrote: post #130
badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Seems like the shop is broken? > Stránka nenalezena > There's been a glitch... > We're not quite sure what went wrong. You can go back, or try looking on our homepage.

Huh, it was working an hour ago. The outdoor 8MP variant was around the 85 euro mark.

Re: My security camera shipped a GitHub admin token in its login page

#143

Post by LastTrain »

em3rgent0rdr wrote: post #129
badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

ESP32-CAM

I so want these to be a viable solution but man my experience so far is that it can barely be made to work and only in the most favorable environments. Compare that to the blink cameras I used to run outside where it occasionally went below -20F and they still went over a year on a couple batteries.

Re: My security camera shipped a GitHub admin token in its login page

#144

Post by tehlike »

badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

You can get close.... I guess...

Some cameras do support thingino, so you can override their firmware. Then there's this: https://openipc.org/supported-hardware/featured

Re: My security camera shipped a GitHub admin token in its login page

#145

Post by gxs »

dev_l1x_be wrote: post #32

Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)

Especially these days there’s really no excuse

Add a skill to your repo that does some basic checks at least, not that hard

Re: My security camera shipped a GitHub admin token in its login page

#146

Post by Multicomp »

kowbell wrote: post #30
inigyou wrote: post #23

Earlier quoted context omitted.

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range. If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"

Agreed 100%! I know there's tough challenges to making this reality, but if https://serverspace.io/about/blog/ipv8-explained-what-we-kno... could be an IRL thing, I would buy company network equipment and use computer OSes that supported this draft standard.

It's a much better compromise and ergonomics to migrate from IPv4 to an IPv4 respecting successor, where IPv6 is just the academic snobbery and utterly alien mental model for not-enough benefits.

For the same reason Unix stuck around and beat up its own successor Plan 9/inferno. That inertia even decades later is the same reason IPv4 still beats IPv6.

IPv8 is more of a linux to unix than a plan 9.

Re: My security camera shipped a GitHub admin token in its login page

#147

Post by dare944 »

> Why would Hanwha Vision need anything remotely related to the DoD? Is it possible that their CI is provided by some centralized team at their parent company Hanwha, where the needs of their sister company Hanwha Aerospace cause the shared platform to have these entries in the CI environment variables? Or maybe because of their other sister company, Hanwha Defense USA, where they make other large scary steel machines

Or... the Department of Warmongers (nee DoD) addresses on the device are evidence of a supply-side attack targeting the DoW and carried out using the aforementioned github admin token.

... I mean, while we're in here speculating about truffles and all.

Re: My security camera shipped a GitHub admin token in its login page

#148

Post by TeMPOraL »

CodesInChaos wrote: post #69
aizk wrote: post #46

Department of War IP address? I feel this should be making headlines!

Abusing IP ranges which were assigned to an organization but aren't actually used on the public Internet as private addresses is pretty common. Sure, it's bad practice, but not a big deal.

Of course this looks entirely different when your corporate superstructure has a long and active history of developing military equipment.

Re: My security camera shipped a GitHub admin token in its login page

#149

Post by ErroneousBosh »

inigyou wrote: post #118
SV_BubbleTime wrote: post #77

Earlier quoted context omitted.

>The point of IPv6 was to make the addresses so long they are easy to manage. lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

How many /24s does your organisation have? With IPv6, one block is almost always sufficient.

It's mental that my fairly techy-orientated but otherwise pretty standard UK ISP provides me with a /48 as default.

So I have 1.2 million million million million IPv6 addresses available.

That ought to be enough, eh?

Re: My security camera shipped a GitHub admin token in its login page

#150

Post by inigyou »

accrual wrote: post #49
hhh wrote: post #5

Earlier quoted context omitted.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

I also know of a company who does this. The reason in their case is they act as a network concentrator, bridging hundreds of client IP spaces, so this helps them avoid conflicts with their own space without having to NAT constantly. There is still a lot of NAT for the more common ranges.

If they converted to IPv6, they could easily have a globally unique address space. Real globally unique, not probabilistic.
Post reply on HN